# US 10,484,336 B2 · Systems and methods for a unique mechanism of providing ‘clientless SSLVPN’ access to a variety of web-applications through a SSLVPN gateway

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,484,336 B2
- Document ID: US10484336B2
- Status: Granted
- Kind: B2
- Application number: 15/154,227
- Filed: 2016-05-13
- Published: 2017-11-16
- Granted: 2019-11-19
- Earliest claimed: 2016-05-13
- Assignees: Citrix Systems, Inc.
- Applicants: Citrix Systems, Inc.
- Inventors: Pintu Kumar; Punit Gupta; Vignesh Rajendran
- Web page: https://patentgrep.com/patent/US10484336B2

## CPC

- H04L 63/0272: {Virtual private networks}
- G06F 16/95: Retrieval from the web
- H04L 61/301: Name conversion
- H04L 61/4511: using domain name system [DNS]
- H04L 63/0281: {Proxies}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70)
- H04L 63/168: {above the transport layer}
- H04L 2101/345: containing wildcard characters
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

The present disclosure is directed towards systems and methods for rewriting a HTTP response transmitted via a clientless SSL VPN session. An intermediary device may identify, in a HTTP response transmitted via a clientless SSL VPN session, an absolute URL that includes a first hostname of the server. The device may provide a unique string corresponding to the first hostname of the server. The device may generate a URL segment by combining the unique string with a second hostname of the device. The device may rewrite the absolute URL by replacing the first hostname in the absolute URL with the generated URL segment. A domain name system (DNS) server for the client may be configured with a DNS entry comprising a wildcard combined with the second hostname, to cause the DNS server to resolve the rewritten absolute URL to an IP address of the device.

## Claims

### Claim 1

A method for rewriting a hypertext transfer protocol (HTTP) response transmitted via a clientless secure socket layer virtual private network (SSL VPN) session, the method comprising:
identifying, by a device intermediary between a client and a server, in a HTTP response transmitted via a clientless SSL VPN session, an absolute uniform resource locator (URL) that includes a first hostname of the server, the device having a second hostname;
providing, by the device, a unique string corresponding to the first hostname of the server;
generating, by the device, a URL segment by combining the unique string with the second hostname of the device;
rewriting, by the device, the absolute URL by replacing the first hostname in the absolute URL with the generated URL segment;
providing, by the device, a domain name system (DNS) server with a DNS entry to resolve the rewritten absolute URL to an internet protocol (IP) address of the device, the DNS entry comprising a wildcard prefixed to the second hostname, the wildcard resolving with a string prior to the second hostname in the rewritten absolute URL which includes the unique string corresponding to the first hostname of the server, to route to the device corresponding to the second hostname;
receiving, by the device from the client, a request to access the server, the request including the rewritten absolute URL, the request routed to the device by the DNS server using the DNS entry to resolve the rewritten absolute URL to the IP address of the device; and
decoding, by the device using the first hostname, the URL segment in the rewritten absolute URL of the request, to communicate with the server.

### Claim 2 (depends on 1)

The method of claim 1, wherein generating the URL segment comprises generating the URL segment by appending the second hostname to the unique string separated by a period character.

### Claim 3 (depends on 1)

The method of claim 1, further comprising receiving, by the device, the request including a HTTP request initiated at the client using the rewritten absolute URL, wherein the DNS resolves the rewritten absolute URL to the IP address of the device to direct the HTTP request to the device.

### Claim 4 (depends on 3)

The method of claim 3, further comprising identifying, by the device, the unique string from a host header of the received HTTP request, and decoding the unique string to obtain the first hostname of the server.

### Claim 5 (depends on 4)

The method of claim 4, further comprising communicating, by the device, with the server according to the obtained first hostname, regarding the received HTTP request.

### Claim 6 (depends on 1)

The method of claim 1, wherein providing the unique string comprises generating the unique string from the first hostname using an encoding scheme.

### Claim 7 (depends on 1)

The method of claim 1, further comprising maintaining, by the device, a relative URL in the HTTP response or another HTTP response unchanged when transmitted through the device via the clientless SSL VPN session.

### Claim 8 (depends on 1)

The method of claim 1, further comprising maintaining, by the device, a root relative URL in the HTTP response or another HTTP response unchanged when transmitted through the device via the clientless SSL VPN session.

### Claim 9 (depends on 1)

The method of claim 1, further comprising providing, by the device, a SSL certificate to one or more clients connecting to the device using SSL or HTTP secure (HTTPS), wherein the SSL certificate includes a field that comprises the wildcard combined with the second hostname of the device.

### Claim 10 (depends on 1)

The method of claim 1, further comprising removing, by the device, a domain value in a set-cookie header of the HTTP response, and storing the removed domain value with a corresponding cookie value.

### Claim 11

A system for rewriting a hypertext transfer protocol (HTTP) response transmitted via a clientless secure socket layer virtual private network (SSL VPN) session, the system comprising:
a policy engine, comprising a hardware processor, executable on a device intermediary between a client and a server, configured to identify in a HTTP response transmitted via a clientless SSL VPN session, an absolute uniform resource locator (URL) that includes a first hostname of the server, the device having a second hostname;
an encoder executable on the device, configured to provide a unique string corresponding to the first hostname of the server;
a rewriter executable on the device, configured to:
generate a URL segment by combining the unique string with the second hostname of the device,
rewrite the absolute URL by replacing the first hostname in the absolute URL with the generated URL segment, and
provide a domain name system (DNS) server with a DNS entry to resolve the rewritten absolute URL to an internet protocol (IP) address of the device, the DNS entry comprising a wildcard prefixed to the second hostname, the wildcard resolving with a string prior to the second hostname in the rewritten absolute URL which includes the unique string corresponding to the first hostname of the server, to route to the device corresponding to the second hostname;
a receiver executable on the device, configured to receive, from the client, a request to access the server, the request including the rewritten absolute URL, the request routed to the device by the DNS server using the DNS entry to resolve the rewritten absolute URL to the IP address of the device; and a decoder executable on the device, configured to decode, using the first hostname, the URL segment in the rewritten absolute URL of the request, to communicate with the server.

### Claim 12 (depends on 11)

The system of claim 11, wherein the rewriter is further configured to generate the URL segment by appending the second hostname to the unique string separated by a period character.

### Claim 13 (depends on 11)

The system of claim 11, wherein the receiver is further configured to receive the request including a HTTP request initiated at the client using the rewritten absolute URL, wherein the DNS resolves the rewritten absolute URL to the IP address of the device to direct the HTTP request to the device.

### Claim 14 (depends on 13)

The system of claim 13, wherein the decoder is further configured to identify the unique string from a host header of the received HTTP request, and decoding the unique string to obtain the first hostname of the server.

### Claim 15 (depends on 14)

The system of claim 14, wherein the device is configured to communicate with the server according to the obtained first hostname, regarding the received HTTP request.

### Claim 16 (depends on 11)

The system of claim 11, wherein the encoder is configured to generate the unique string from the first hostname using an encoding scheme.

### Claim 17 (depends on 11)

The system of claim 11, wherein the rewriter is configured to maintain a relative URL in the HTTP response or another HTTP response unchanged when transmitted through the device via the clientless SSL VPN session.

### Claim 18 (depends on 11)

The system of claim 11, wherein the rewriter is configured to maintain a root relative URL in the HTTP response or another HTTP response unchanged when transmitted through the device via the clientless SSL VPN session.

### Claim 19 (depends on 11)

The system of claim 11, wherein the rewriter is further configured to provide a SSL certificate to one or more clients connecting to the device using SSL or HTTP secure (HTTPS), wherein the SSL certificate includes a field that comprises the wildcard combined with the second hostname of the device.

### Claim 20 (depends on 11)

The system of claim 11, wherein the rewriter further is configured to remove a domain value in a set-cookie header of the HTTP response, and stores the removed domain value with a corresponding cookie value.